Blog
🔗 Blog
Billy Joel made a blog on his home computer and has started working on it. It's going to be so awesome!
Enumerate this box and find the 2 flags that are hiding on it! Billy has some weird things going on his laptop. Can you maneuver around and get what you need? Or will you fall down the rabbit hole...
In order to get the blog to work with AWS, you'll need to add blog.thm to your /etc/hosts file.
Task 1 - Deploy the machine
🎯 Target IP: 10.10.139.146
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix, while Windows systems usually have a TTL of 128 secs.
Of course, start to check information scanning open ports:
sudo
run as root
sC
run default scripts
sV
enumerate versions
A
aggressive mode
T4
run a bit faster
oN
output to file with nmap formatting
It looks like there are 4 open ports on the machine: 22,80,139,445.
Now, we need to search which services are running on open ports:
Task 3 - Root.txt?
Then we can start to see website (port 80):
and see page source for checking information disclosure.
but we don't find precious info.
Another good thing to do, is find hidden paths on website using gobuster
Very good, we can start to check these web dir:
we just know that wp-admin is a default login path for wordpress, then we go there:
we can try to login with admin/billy/kare:password (that are present on blog page how authors), but it doesn't works.
We can launch wp-scan to give info from wordpress:
we've find and id_rsa:
remembering that we've user and id rsa, first take permission to id_rsa file and try login:
We're in, try to find user.txt flag using find command:
Task 4 - user.txt?
We can do sudo -l command to discover user's permissions.
Well done! Root flag found!
4.1 Where was user.txt found?
4.2 What CMS was Billy using?
4.3 What version of the above CMS was being used?
Last updated